Microsoft now updating Windows without user permission

[jdc2000]

Link:

http://blogs.zdnet.com/hardware/?cat=55&tag=nl.e539

[Welshjim]

jdc2000--I would like to think that the blogger has Automatic Updates turned on in his Security window. Or that the changes occurred as part of one of the monthly updates. But...

[SpywareDr]

Windows Secrets Newsletter • Issue 122 • 2007-09-13

Microsoft updates Windows without users' consent
http://windowssecrets.com/paid/070913/#story1By Scott Dunn

Microsoft has begun patching files on Windows XP and Vista without users' knowledge, even when the users have turned off auto-updates.

Many companies require testing of patches before they are widely installed, and businesses in this situation are objecting to the stealth patching.

Files changed with no notice to users

In recent days, Windows Update (WU) started altering files on users' systems without displaying any dialog box to request permission. The only files that have been reportedly altered to date are nine small executables on XP and nine on Vista that are used by WU itself. Microsoft is patching these files silently, even if auto-updates have been disabled on a particular PC.

It's surprising that these files can be changed without the user's knowledge. The Automatic Updates dialog box in the Control Panel can be set to prevent updates from being installed automatically. However, with Microsoft's latest stealth move, updates to the WU executables seem to be installed regardless of the settings — without notifying users.

When users launch Windows Update, Microsoft's online service can check the version of its executables on the PC and update them if necessary. What's unusual is that people are reporting changes in these files although WU wasn't authorized to install anything.

[...continues (http://windowssecrets.com/paid/070913/#story1)...]

[jdc2000]

Microsoft could find themselves in trouble over this one. As the quote states, many companies require testing of patches before they are installed, including many in my area. There have been too many problems with some Microsoft patches in the past, including patches to the auto update system to allow automatic updates on networks with lots of machines. And, if they are automatically updating this in stealth mode, who knows what else they may decide to update. It would appear to be in violation of their own stated policies on this also.

[Welshjim]

I have a contact within MS who is looking into this. I will post if he can find anything out.

[jdc2000]

Update links:

http://blogs.zdnet.com/hardware/?p=780&tag=nl.e539

http://blogs.zdnet.com/hardware/?p=787

Read the comments on this one also:
http://blogs.technet.com/mu/archive/2007/09/13/how-windows-update-keeps-itself-up-to-date.aspx

[Welshjim]

To me the key words in the Nate Clinton page are "the Windows Update client is configured to automatically check for updates anytime a system uses the WU service, independent of the selected settings for handling updates "
I have no problem with WU "checking" for updates, but that is not a license to install them without notice or permission.
What did Mr. Clinton want to say by using the word "check"? Based on Adrian Kingsley-Hughes' experience it seems Mr. Clinton really means "install" regardless of the settings in Automatic Update.
A bit disappointing.